Conformity Assessments for High-Risk AI

The legal framework

Before a high-risk AI system is placed on the market or put into service in the EU, its provider must show that the system meets the requirements of Chapter III, Section 2 of the AI Act (Regulation (EU) 2024/1689). This is done through a conformity assessment under Article 43. Those obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, following Regulation (EU) 2026/1744.

The requirements to be demonstrated

The system must have:

• a risk management system that runs through the life cycle (Article 9);
• data and data governance measures, including examination for bias (Article 10);
• technical documentation drawn up before market entry (Article 11 and Annex IV);
• automatic logging of events (Article 12);
• instructions for use and transparency towards deployers (Article 13);
• measures for effective human oversight (Article 14);
• an appropriate level of accuracy, robustness and cybersecurity (Article 15).

The provider must also operate a quality management system (Article 17).

Which assessment route applies

Two routes exist for Annex III systems. For systems in areas 2 to 8 (critical infrastructure, education, employment, essential services, law enforcement, migration, justice), the provider follows the internal control procedure of Annex VI. It checks itself that its quality management system and documentation comply, without a notified body.

For biometric systems (area 1), the provider may use the internal procedure only if it has applied harmonised standards or common specifications in full. Otherwise it must involve a notified body under Annex VII. For systems that are products or safety components under Annex I, the conformity assessment of the sectoral legislation applies, and the AI Act requirements are checked as part of it.

Harmonised standards, once their references are published, give a presumption of conformity (Article 40).

After the assessment

When the assessment is complete, the provider:

• draws up an EU declaration of conformity (Article 47);
• affixes the CE marking (Article 48);
• registers the system in the EU database (Article 49), including systems that the provider considers exempt under Article 6(3);
• keeps documentation available for ten years (Article 18).

A new conformity assessment is required after a substantial modification (Article 43(4)). The provider must also monitor the system after market entry (Article 72) and report serious incidents to the market surveillance authority (Article 73).

In practice

A Kortrijk start-up develops software that assesses the creditworthiness of consumers. It is a high-risk system in Annex III, area 5. The start-up follows the Annex VI internal procedure: it sets up a quality management system, writes the technical documentation, tests for bias in its training data, builds logging and an operator interface for human review, and assesses whether the system meets Articles 9 to 15. A founder signs the EU declaration of conformity, the CE marking is affixed and the system is registered.

Eighteen months later, the start-up retrains the model on new data and adds a new category of input. That is likely a substantial modification and needs a new assessment. Had the model only been updated within the performance range foreseen in the original documentation, it would not be.

A company that buys such a system as deployer does not carry out a conformity assessment, but should ask for the declaration of conformity, the registration number and the instructions for use. See provider or deployer.

Tracking each step with its evidence is a task for our AI Act register. Where the system processes personal data, a link to the records of processing shows the data governance behind it.

It helps to start with the documentation rather than with the test. Technical documentation under Annex IV forces the provider to describe the intended purpose, the design choices, the data used and the validation results, and gaps in these are usually where an assessment fails. Starting early also leaves room to adapt to harmonised standards as they are published.

Frequently asked questions

Is a notified body always needed?

No. For most Annex III systems the provider assesses its own conformity. A notified body is required in the biometrics case described above and under some sectoral legislation.

How long does a conformity assessment take?

It depends on how mature the provider's quality management and documentation are. It is better planned in months than in weeks.

Can a deployer rely on the provider's assessment?

For the provider's duties, yes. The deployer remains responsible for its own duties under Article 26, such as oversight and informing affected persons.

Does a general-purpose AI model need a conformity assessment?

Not as such. Models have their own obligations. A high-risk system built on a model does need one.

How this connects

AI Act compliance covers the preparation for these assessments. Which systems need one follows from risk classification, and when from the timeline.